[java-oidc-common] branch main updated: Allow local JOSE credential resolver resolve credentials without kid

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=eef1755e1db8120f6d671463856fc90148591e9d

The following commit(s) were added to refs/heads/main by this push:
     new eef1755  Allow local JOSE credential resolver resolve credentials without kid
eef1755 is described below

commit eef1755e1db8120f6d671463856fc90148591e9d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 10 12:42:08 2023 +0000

    Allow local JOSE credential resolver resolve credentials without kid
---
 .../impl/LocalJOSEObjectCredentialResolver.java    | 17 ++++++++++++----
 .../LocalJOSEObjectCredentialResolverTest.java     | 23 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index 53eadd8..b1b4cd2 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -79,6 +79,8 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
  * </ol>
  * Adds either 'kid' or 'public key' to the criteria set sent to the local credential resolver for resolution.
  * 
+ * @since 2.2.0
+ * 
  */
 public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
     
@@ -122,6 +124,7 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
         
         for (final Credential inputCred : credentials) {
             if (isLocalCredential(inputCred)) {
+                // TODO this is impossible in the JOSE case implemented here?
                 log.debug("Input credential was local, including in results");
                 results.add(inputCred);
             } else if (inputCred.getPublicKey() != null) {
@@ -134,6 +137,7 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
                     // Also filter public key by keyID if one exists in the 'kid' parameter.
                     // This is also caught upstream, so add in-case resolver needs it and filter
                     // anyway.
+                    log.trace("Adding 'kid' value '{}' to credential resolver", kid);
                     criteria.add(new EvaluableKeyIDCredentialCriterion(kid)); 
                 }
                 final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
@@ -145,16 +149,21 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
             }
         }
         
-        // If 'kid' exists in the header, also resolve by kid (in-case there were no input credentials)
-        if (kid != null) {
+        // If we have not found credentials by matching those from the JOSE object, try and find local credentials only
+        if (results.isEmpty()) {        
             final CriteriaSet criteria = new CriteriaSet();
-            criteria.add(new EvaluableKeyIDCredentialCriterion(kid));
+            // If 'kid' exists in the header, also resolve by kid for efficiency.
+            if (kid != null) {    
+                log.trace("Adding 'kid' value '{}' to credential resolver", kid);
+                criteria.add(new EvaluableKeyIDCredentialCriterion(kid));                
+            } 
             final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
-            log.trace("Found {} credential(s) from 'kid' criterion alone", localCredentials.size());
+            log.trace("Found {} local credential(s)", localCredentials.size());
             // There is no point in adding a duplicate credential, so filter out those already resolved
             results.addAll(filterAlreadyContained(results, localCredentials));
         }
         
+        
         credentials.clear();
         credentials.addAll(results);
     }
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
index 5b81f9b..69d332f 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
@@ -159,6 +159,29 @@ public class LocalJOSEObjectCredentialResolverTest {
         assertTrue(resolvedCredential.get(0).getKeyNames().contains("mock-key"));
     }
     
+    /* There is no KID to use for filtering, but a credential should be returned anyway. */
+    @Test
+    public void testSuccessful_NoKeyIDInJOSEHeader() throws Exception {
+        final JWEObject jweObject = 
+                new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
+                .contentType("JWT")
+                // No Key ID on purpose
+                //   .keyID("mock-key")
+                .build(),
+                new Payload(createdSignedJWT()));
+        jweObject.encrypt(new RSAEncrypter(localRSAKey));
+        final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
+        System.out.println(jwe.serialize());
+        
+        final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
+        final List<Credential> resolvedCredential = StreamSupport.stream(
+                resolver.resolve(criteria).spliterator(), false).collect(Collectors.toList());
+        assertNotNull(resolvedCredential);
+        assertEquals(resolvedCredential.size(),1);
+        assertNotNull(resolvedCredential.get(0).getPrivateKey());
+        assertTrue(resolvedCredential.get(0).getKeyNames().contains("mock-key"));
+    }
+    
     /* Just 'kid' no 'jwk'.*/
     @Test
     public void testUnSuccessful_KeyIDInJOSEHeaderDifferentThanLocalCred() throws Exception {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.